﻿// Module.cpp : implementation file
//

#include "stdafx.h"
#include "TOOLBOX4.h"
#include "Module.h"

#include <GetHostAsset.h>
#include <GetLogCollection.h>
#include <DataBaseLog.h>
//#include "GetSystemSetting.h"			// 网络连接 进程 服务 账户安全 //移到Module.h中了
#include "GetSysSecurityInfo.h"			// 安装软件 文件共享
#include "ParseWebResultFile.h"			// Web结果写入Sqlite3
#include "MySuspiciousFile.h"
#include "TypeStruct.h"
#include <TlHelp32.h>
#include <comdef.h>
#include <set>
#include <string>

//#include "GetSystemInfo.h"
//#include <list>
#include <AclAPI.h> // 检查策略需要的头文件




IMPLEMENT_DYNAMIC(CModule, CWnd)

CModule::CModule()
{
	CString IniPath = CTOOLBOX4App::ms_strResultPath;
	CString IniPath1 = CTOOLBOX4App::ms_strResultPath;
	//IniPath += _T("\\采集结果\\OriginalCfg.ini");
	IniPath1 += _T("\\采集结果\\OriginalCfg.ydini");
	//if(IsFileExist(IniPath1))
	std::wstring strEventTaskId;
	GetIniFileKeyValue(IniPath1.GetBuffer(), _T("MacAndTaskId"), _T("EventTaskId"), strEventTaskId);
	m_csEventTaskId = strEventTaskId.c_str();
	//else
		//GetIniFileKeyValue(IniPath, _T("MacAndTaskId"), _T("EventTaskId"), m_csEventTaskId);
}

CModule::~CModule()
{
}


BOOL CModule::m_bStop = FALSE;

std::vector<PROCESS_INFORMATION> CModule::m_vHandle;


CString CModule::m_csEventTaskId = NULL;

//判断系统是否是64位的系统
BOOL Is64bitSystem()
{
	SYSTEM_INFO si;
	GetNativeSystemInfo(&si);

	if (si.wProcessorArchitecture == PROCESSOR_ARCHITECTURE_AMD64 ||    
		si.wProcessorArchitecture == PROCESSOR_ARCHITECTURE_IA64 )
	{
		return TRUE;
	}
	else
	{
		return FALSE;
	} 
}










/************************************************************************/
//	主机日志功能模块，包含（系统日志，应用程序日志，安全日志）三部分
//	hWnd		接受消息的窗口句柄
//	nType		采集类型， 1=快速采集，2=全盘采集， 3=自定义采集
//	begTime		起始时间，
//	注：快速采集只采集最近30天数据，全盘采集会采集所有数据  
//自定义采集:
//	不能传入endTime,所以将begTime之后的所有日志都采集回来,
//	然后将日志时间和endTime做对比,过滤掉endTime之后的日志,
//	完成begTime-endTime日志的采集.(在接收消息处完成此过程)
/************************************************************************/
/*
void CModule::HostLog(HWND hWnd, int nType,CTime begTime, sqlite3*db)
{
	//// 检查主机审核策略,并提示用户
	//list<ACCOUNTINFO> info;
	//CheckLogAudit(info);
	//CString csHint = _T("");
	//for(list<ACCOUNTINFO>::iterator  ib = info.begin();ib != info.end();++ib)
	//{
	//	ACCOUNTINFO of = *ib;
	//	if(_tcscmp(of.strValue, _T("审核成功，审核失败")) != 0)
	//	{
	//		if(_tcscmp(of.strName, _T("审核对象访问")) == 0 
	//			|| _tcscmp(of.strName, _T("审核目录服务访问")) == 0 
	//			|| _tcscmp(of.strName, _T("审核系统事件")) == 0
	//			|| _tcscmp(of.strName, _T("审核账户登录事件")) == 0)
	//			continue;
	//		else
	//		{
	//			if(csHint.IsEmpty())
	//				csHint = of.strName;
	//			else
	//			{
	//				csHint += _T("、");
	//				csHint += of.strName;
	//			}
	//		}
	//	}
	//}
	//if(!csHint.IsEmpty())
	//{
	//	csHint += _T("未开启或者开启不全,对应项则没有相应日志产生,会对分析结果造成一定影响!");
	//	MessageBox(csHint, _T("提示:"), MB_ICONWARNING);
	//}

	CString strMac = CTOOLBOX4App::ms_strMacAddr;
	CString TaskID = CModule::m_csEventTaskId;
	CString LogPath=CTOOLBOX4App::ms_strFullResultPath;
	LogPath=LogPath+_T("主机层\\");
	CString AppLog;
	CString SysLog;
	CString SecLog;
	AppLog=LogPath+_T("Application.evtx");
	SysLog=LogPath+_T("System.evtx");
	SecLog=LogPath+_T("Security.evtx");
	TCHAR szPath[MAX_PATH] = { 0 };
	GetSystemDirectory(szPath, MAX_PATH);
	CString sysPath;
	sysPath.Format(_T("%s"),szPath);
	CString sysLogPath;
	
	if (myWow64EnableWow64FsRedirection(FALSE))//关闭重定向
	{
		sysLogPath=sysPath+_T("\\winevt\\Logs\\Application.evtx");
		if(!CopyFile(sysLogPath,AppLog,TRUE))
		{
			int dret=GetLastError();
		}
		sysLogPath=_T("");
		sysLogPath=sysPath+_T("\\winevt\\Logs\\System.evtx");
		if(!CopyFile(sysLogPath,SysLog,TRUE))
		{
			int dret=GetLastError();
		}
		sysLogPath=_T("");
		sysLogPath=sysPath+_T("\\winevt\\Logs\\Security.evtx");
		if(!CopyFile(sysLogPath,SecLog,TRUE))
		{
			int dret=GetLastError();
		}
		myWow64EnableWow64FsRedirection(TRUE);
	}
	switch(nType)
	{
	case 1: // 快速采集 
			{
				// 主机日志   采集一个月内的日志
				CTime t1 = CTime::GetCurrentTime();
				t1 -= 30 * 24 * 3600;      // 1个月
				SYSTEMTIME st;
				t1.GetAsSystemTime(st);
				CTime endTime;
				endTime=t1;
				
				GetSystemLogEx(hWnd, CHECK_SYSLOG, m_bStop, st,endTime, db,nType,strMac,TaskID);

				if(CModule::m_bStop)
					return;
			//	pGetSystemLogEx GetApplicationLogEx = (pGetSystemLogEx)GetProcAddress(hd,"GetApplicationLogEx");
			//	if (GetApplicationLogEx)  // 应用程序日志
				{
					GetApplicationLogEx(hWnd, CHECK_APPLOG, m_bStop, st,endTime, db,nType,strMac,TaskID);
				}
				if(CModule::m_bStop)
					return;

				GetSecurityLogEx(hWnd, CHECK_SECLOG, m_bStop, st,endTime, db,nType,strMac,TaskID);
				break;
			}
	case 2: // 全盘采集
		{
			// 主机日志   采集所有的日志 (1970.1.1,0:0:0之后的所有日志)
			
			CTime endTime;
			endTime=m_endTime;
			SYSTEMTIME st;
				
			st.wYear = 1971;
			st.wMonth = 1;
			st.wDay = 1;
			st.wHour = 0;
			st.wMinute = 0;
			st.wSecond = 0;

			GetSystemLogEx(hWnd, CHECK_SYSLOG, m_bStop, st,endTime, db,nType,strMac,TaskID);
			if(CModule::m_bStop)
				return;
			//pGetSystemLogEx GetApplicationLogEx = (pGetSystemLogEx)GetProcAddress(hd,"GetApplicationLogEx");
			//if (GetApplicationLogEx)  // 应用程序日志
			//{
				GetApplicationLogEx(hWnd, CHECK_APPLOG, m_bStop, st,endTime, db,nType,strMac,TaskID);
			//}
				
			if(CModule::m_bStop)
				return;

			GetSecurityLogEx(hWnd, CHECK_SECLOG, m_bStop, st,endTime, db,nType,strMac,TaskID);

			break;
		}
	case 3: // 自定义采集
		{ 
			SYSTEMTIME beg;
			CTime endTime;
			endTime=m_endTime;
			
			beg.wYear = begTime.GetYear();
			beg.wMonth = begTime.GetMonth();
			beg.wDay = begTime.GetDay();
			beg.wHour = 0;
			beg.wMinute = 0;
			beg.wSecond = 0;
			nType=3;
			GetSystemLogEx(hWnd, CHECK_SYSLOG, m_bStop, beg,endTime, db,nType,strMac,TaskID);
			if(CModule::m_bStop)
				return;
			//pGetSystemLogEx GetApplicationLogEx = (pGetSystemLogEx)GetProcAddress(hd,"GetApplicationLogEx");
			//if (GetApplicationLogEx)  // 应用程序日志
			//{
				GetApplicationLogEx(hWnd, CHECK_APPLOG,m_bStop, beg,endTime, db,nType,strMac,TaskID);
			//}
			if(CModule::m_bStop)
				return;

			GetSecurityLogEx(hWnd, CHECK_SECLOG, m_bStop, beg,endTime, db,nType,strMac,TaskID);

			break;
		}
	}

}
*/
void CModule::HostLog(HWND hWnd, int nType,CTime begTime, sqlite3*db,CString dbName)
{
	//// 检查主机审核策略,并提示用户
	//list<ACCOUNTINFO> info;
	//CheckLogAudit(info);
	//CString csHint = _T("");
	//for(list<ACCOUNTINFO>::iterator  ib = info.begin();ib != info.end();++ib)
	//{
	//	ACCOUNTINFO of = *ib;
	//	if(_tcscmp(of.strValue, _T("审核成功，审核失败")) != 0)
	//	{
	//		if(_tcscmp(of.strName, _T("审核对象访问")) == 0 
	//			|| _tcscmp(of.strName, _T("审核目录服务访问")) == 0 
	//			|| _tcscmp(of.strName, _T("审核系统事件")) == 0
	//			|| _tcscmp(of.strName, _T("审核账户登录事件")) == 0)
	//			continue;
	//		else
	//		{
	//			if(csHint.IsEmpty())
	//				csHint = of.strName;
	//			else
	//			{
	//				csHint += _T("、");
	//				csHint += of.strName;
	//			}
	//		}
	//	}
	//}
	//if(!csHint.IsEmpty())
	//{
	//	csHint += _T("未开启或者开启不全,对应项则没有相应日志产生,会对分析结果造成一定影响!");
	//	MessageBox(csHint, _T("提示:"), MB_ICONWARNING);
	//}
	CString strMac = CTOOLBOX4App::ms_strMacAddr;
	CString TaskID = CModule::m_csEventTaskId;
	WCHAR sys_drive[64] = { 0 };
	CString sys_path;
	GetSystemDirectory(sys_drive, 256);
	sys_path.Format(L"%s", sys_drive);
	CString strOldLogName=sys_path+_T("\\winevt\\Logs\\System.evtx");
	CString strLogNewDir=dbName+_T("主机日志");
	CreateDirectory(strLogNewDir,nullptr);
	/*CString strNewLogName=_T(" ")+strLogNewDir+_T("\\System.evtx ");//复制新的日志文件路径
	CString strLogcsvName=_T(" ")+strLogNewDir+_T("\\Security.csv ");//导出日志格式
	CString strProcName=_T(" ")+strLogNewDir+_T("\\Proc.csv ");//进程日志信息
	CString strDBProcName=strLogNewDir+_T("\\Proc.csv ");
	CString strDBLogcsvName=strLogNewDir+_T("\\Security.csv ");
	CString strBatPath;*/
	if (myWow64EnableWow64FsRedirection(FALSE))//关闭重定向
	{
		int dret;
		CString strNewLogName1=strLogNewDir+_T("\\System.evtx");
		if(!CopyFile(strOldLogName,strNewLogName1,TRUE))
		{
			 dret=GetLastError();
		}
		strOldLogName=sys_path+_T("\\winevt\\Logs\\Application.evtx");
		 strNewLogName1=strLogNewDir+_T("\\Application.evtx");
		// CString strNewLogName1=strLogNewDir+_T("\\Security.evtx ");
		if(!CopyFile(strOldLogName,strNewLogName1,TRUE))
		{
			 dret=GetLastError();
		}
		myWow64EnableWow64FsRedirection(TRUE);
	}
	switch(nType)
	{
	case 1: // 快速采集 
			{
				// 主机日志   采集一个月内的日志
				CTime t1 = CTime::GetCurrentTime();
				t1 -= 30 * 24 * 3600;      // 1个月
				SYSTEMTIME st;
				t1.GetAsSystemTime(st);
				CTime endTime;
				endTime=t1;
				
				GetSystemLogEx(hWnd, CHECK_SYSLOG, m_bStop, st,endTime, db,nType,dbName,strMac,TaskID);
				if(CModule::m_bStop)
					return;
				
				GetApplicationLogEx(hWnd, CHECK_APPLOG, m_bStop, st,endTime, db,nType,dbName,strMac,TaskID);
				
				if(CModule::m_bStop)
					return;
				GetSecurityLogEx(hWnd, CHECK_SECLOG, m_bStop, st,endTime, db,nType,dbName,strMac,TaskID);
		
				break;
			}
	case 2: // 全盘采集
		{
			// 主机日志   采集所有的日志 (1970.1.1,0:0:0之后的所有日志)
			/*SYSTEMTIME endTime;
			endTime.wYear = m_endTime.GetYear();
			endTime.wMonth = m_endTime.GetMonth();
			endTime.wDay = m_endTime.GetDay();
			endTime.wHour = 24;
			endTime.wMinute = 0;
			endTime.wSecond = 0;*/
			CTime endTime;
			endTime=m_endTime;
			SYSTEMTIME st;

			st.wYear = 1971;
			st.wMonth = 1;
			st.wDay = 1;
			st.wHour = 0;
			st.wMinute = 0;
			st.wSecond = 0;

			//GetSystemLogEx(hWnd, CHECK_SYSLOG, m_bStop, st);
			if(CModule::m_bStop)
				return;
			//pGetSystemLogEx GetApplicationLogEx = (pGetSystemLogEx)GetProcAddress(hd,"GetApplicationLogEx");
			//if (GetApplicationLogEx)  // 应用程序日志
			//{
			//	GetApplicationLogEx(hWnd, CHECK_APPLOG, m_bStop, st);
			//}
			GetSystemLogEx(hWnd, CHECK_SYSLOG, m_bStop, st,endTime, db,nType,dbName,strMac,TaskID);
			GetApplicationLogEx(hWnd, CHECK_APPLOG, m_bStop, st,endTime, db,nType,dbName,strMac,TaskID);
			if(CModule::m_bStop)
				return;

			GetSecurityLogEx(hWnd, CHECK_SECLOG, m_bStop, st,endTime, db,nType,dbName,strMac,TaskID);

			break;
		}
	case 3: // 自定义采集
		{ 
			SYSTEMTIME beg;
			CTime endTime;
			endTime=m_endTime;
			/*endTime.wYear = m_endTime.GetYear();
			endTime.wMonth = m_endTime.GetMonth();
			endTime.wDay = m_endTime.GetDay();
			endTime.wHour = m_endTime.GetHour();
			endTime.wMinute = 0;
			endTime.wSecond = 0;*/
			beg.wYear = begTime.GetYear();
			beg.wMonth = begTime.GetMonth();
			beg.wDay = begTime.GetDay();
			beg.wHour = 0;
			beg.wMinute = 0;
			beg.wSecond = 0;
			nType=3;
			GetSystemLogEx(hWnd, CHECK_SYSLOG, m_bStop, beg,endTime,db,nType,dbName,strMac,TaskID);
			if(CModule::m_bStop)
				return;
			//pGetSystemLogEx GetApplicationLogEx = (pGetSystemLogEx)GetProcAddress(hd,"GetApplicationLogEx");
			//if (GetApplicationLogEx)  // 应用程序日志
			//{
				GetApplicationLogEx(hWnd, CHECK_APPLOG, m_bStop, beg,endTime,db,nType,dbName,strMac,TaskID);
			//}
			//GetSecurityLogEx(hWnd, CHECK_SYSLOG, m_bStop, beg,endTime, db,nType,dbName,strMac,TaskID);
			//GetSecurityLogEx(hWnd, CHECK_APPLOG, m_bStop, beg,endTime, db,nType,dbName,strMac,TaskID);
			if(CModule::m_bStop)
				return;
			GetSecurityLogEx(hWnd, CHECK_SECLOG, m_bStop, beg,endTime, db,nType,dbName,strMac,TaskID);

			break;
		}
	}
}

// 文件操作痕迹
void CModule::FileTrace(HWND hWnd, sqlite3*db)
{

	GetFileOperationLightEx(hWnd,CHECK_FILECHECK,m_bStop, db, CTOOLBOX4App::ms_strMacAddr, m_csEventTaskId);
}
// 系统补丁
void CModule::PathInfoTrace(HWND hWnd, sqlite3*db)
{
	GetPathInfo( hWnd,CHECK_PATHINFO,m_bStop,db,CTOOLBOX4App::ms_strMacAddr, m_csEventTaskId);
}
	// 日志策略检测
void CModule::LogPolicyTrace(HWND hWnd, sqlite3*db)
{
	GetLogPolicy( hWnd,CHECK_LOGPOLICY,m_bStop,db,CTOOLBOX4App::ms_strMacAddr, m_csEventTaskId);
}
// ARP
void CModule::ARPTrace(HWND hWnd, sqlite3*db)
{
	//ARP记录
	//sqlite3_exec(db,"begin;",0,0,0);
	GetArpLists(hWnd,CHECK_ARP,m_bStop,db,CTOOLBOX4App::ms_strFullResultPath,CTOOLBOX4App::ms_strMacAddr, m_csEventTaskId);
	//sqlite3_exec(db,"commit;",0,0,0);
	
}
//数据库日志
void CModule::DataBaseLogInfo(HWND hWnd, sqlite3*db,int nType,CTime stStartTime,CTime stEndTime)

{
	if(nType==1)
	{
		CTime t1 = CTime::GetCurrentTime();	// 结束时间是当前时间
		stEndTime=t1;
		t1 -= 30 * 24 * 3600;      // 1个月
		stStartTime=t1;
		
	}
	GetDataBaseLog(hWnd,CHECK_DATABASELOGINFO,m_bStop,stStartTime,stEndTime,db,nType,CTOOLBOX4App::ms_strMacAddr,m_csEventTaskId);
}
// 磁盘文件
void CModule::FileInfoTrace(CString strDisk, HWND hWnd, sqlite3* db, int nType, CTime stStartTime, CTime stEndTime, bool isFast)
{

	if (isFast)
	{
		int type = CHECK_FILEINFO;
		TASKPROGRESS tp;
		tp.nProgress = 100;
		tp.pszText = _T("传送磁盘文件结束");
		::SendMessage(hWnd, WM_RETPROGRESS, (WPARAM)&type, (LPARAM)&tp);
	}
	else
	{
		LightSuspicousFile(hWnd, CHECK_FILEINFO, m_bStop, strDisk.GetBuffer(), db, CTOOLBOX4App::ms_strMacAddr.GetBuffer(), m_csEventTaskId.GetBuffer(), nType, stStartTime.GetTime(), stEndTime.GetTime());
		SuspicousFileNeep(hWnd, CHECK_FILEINFO, m_bStop, strDisk.GetBuffer(), db, CTOOLBOX4App::ms_strMacAddr.GetBuffer(), m_csEventTaskId.GetBuffer(), nType, stStartTime, stEndTime);
	}

}
// usn记录
void CModule::USNTrace(CString strDisk,HWND hWnd, sqlite3*db,int nType,CTime stStartTime,CTime stEndTime, bool isFast)
{
	//usn记录
	if (isFast)
	{
		int type = CHECK_USN;
		TASKPROGRESS tp;
		tp.nProgress = 100;
		tp.pszText = _T("传送USN记录结束");
		::SendMessage(hWnd, WM_RETPROGRESS, (WPARAM)&type, (LPARAM)&tp);
	}
	else
	{
		GetUSNbyVolname(hWnd, CHECK_USN, m_bStop, db, strDisk, CTOOLBOX4App::ms_strMacAddr, m_csEventTaskId, nType, stStartTime, stEndTime);
	}
	
	
}
// dns记录
void CModule::DNSTrace(HWND hWnd, sqlite3*db)
{
	//dns记录
	
	GetDnsRecordList(hWnd,CHECK_DNS,m_bStop,db,CTOOLBOX4App::ms_strFullResultPath,CTOOLBOX4App::ms_strMacAddr, m_csEventTaskId);


}
// 联网痕迹
void CModule::NetTrace(HWND hWnd, int nType, sqlite3*db)
{
	//王浩男 2019-05-16
	//屏蔽互联网深度
	switch(nType)
	{
	case 1:
	{
	//		 // 联网痕迹  轻度
		/*HINSTANCE hdhost = LoadLibrary(SystemInfoDLL);
		if(hdhost)
		{
		typedef void (*pGetWebpageRecodesEx)(HWND ,int ,BOOL&);
		pGetWebpageRecodesEx GetWebpageRecodesEx = (pGetWebpageRecodesEx)GetProcAddress(hdhost,"GetWebpageRecodesEx");
		GetWebpageRecodesEx(hWnd,CHECK_INTERCHECK,m_bStop);
		FreeLibrary(hdhost);
		}
		break;*/
	}
	case 2:
		{
			/*HINSTANCE hdhost = LoadLibrary(SystemInfoDLL);
			if(hdhost)
			{
			typedef void (*pGetWebpageRecodesEx)(HWND ,int ,BOOL&);
			pGetWebpageRecodesEx GetWebpageRecodesEx = (pGetWebpageRecodesEx)GetProcAddress(hdhost,"GetWebpageRecodesEx");
			GetWebpageRecodesEx(hWnd,CHECK_INTERCHECK,m_bStop);
			FreeLibrary(hdhost);
			}
			break;*/
			//// 屏蔽联网痕迹深度
			//break;

			//// 联网痕迹 深度 (全盘)
			//CString str = NULL;
			//int index = 0;
			//for(int i = 0; i < CPage4::m_strDisk.GetLength()/3;i++)
			//{
			//	// 从"C:;D:;E:;"中 拿到CDE
			//	str += CPage4::m_strDisk.Mid(index,1);
			//	index += 3;
			//}
			//NetDeepCheck(hWnd, CHECK_INTERDEEP, m_bStop, str.GetBuffer());
			////NetDeepCheck(hWnd, CHECK_INTERDEEP, m_bStop, _T("CDE"));
			//break;
		}
	case 3:
		{

			GetWebpageRecodesEx(hWnd,CHECK_INTERCHECK,m_bStop, db, CTOOLBOX4App::ms_strMacAddr, m_csEventTaskId);

			break;
			////// 屏蔽联网痕迹深度
			//break;

			//// 联网痕迹 深度(自定义盘符)
			//CString Disk = CPage4::m_strSelDisk;
			//Disk.Remove(_T(':'));
			//Disk.Remove(_T(';'));
			//NetDeepCheck(hWnd, CHECK_INTERDEEP, m_bStop, Disk);
			//break;
		}
	default:
		break;
	}
}
//内存
void CModule::Memory(HWND hWnd, sqlite3* db)
{
	GetMemory( hWnd, CHECK_MEMORY, m_bStop);
}
//硬件信息
void CModule::Hardware(HWND hWnd, sqlite3* db)
{
	GetHardwareEx(hWnd, CHECK_HARDWARE, m_bStop, db, CTOOLBOX4App::ms_strMacAddr.GetBuffer(), m_csEventTaskId.GetBuffer());
}


//无线通讯设备
void CModule::Wireless(HWND hWnd, sqlite3* db)
{
	GetWIFIEx(hWnd, CHECK_WIRELESS, m_bStop, db, CTOOLBOX4App::ms_strMacAddr.GetBuffer(), m_csEventTaskId.GetBuffer());
}

//剪切板
void CModule::Clipboard(HWND hWnd, sqlite3* db)
{
	GetMemory(hWnd, CHECK_CLIPBOARD, m_bStop);
}
// 端口
void CModule::Port(HWND hWnd, sqlite3*db)
{
	GetPortInfo(CHECK_PORTCHECK, hWnd, m_bStop, TEXT(""),db, CTOOLBOX4App::ms_strMacAddr, m_csEventTaskId);
}
// 主机信息
void CModule::HostBaseInfo(HWND hWnd, sqlite3*db)
{
	std::wstring strStartTime;
	GetPCTaiZhangEx(hWnd,CHECK_HOSTBASEINFO,m_bStop, strStartTime, db, CTOOLBOX4App::ms_strMacAddr.GetBuffer(), CModule::m_csEventTaskId.GetBuffer());
	CTOOLBOX4App::m_startTimeFull = strStartTime.c_str();
}
// 启动项
void CModule::StartUpInfo(HWND hWnd, sqlite3*db)
{
	GetStartUpInfo(hWnd,CHECK_STARTUPINFO,m_bStop, db, CTOOLBOX4App::ms_strMacAddr, CModule::m_csEventTaskId);
}
// 计划任务
void CModule::TaskListsInfo(HWND hWnd, sqlite3*db)
{
 	GetTaskListsInfo(hWnd,CHECK_TASKLISTSINFO,m_bStop, db, CTOOLBOX4App::ms_strMacAddr, CModule::m_csEventTaskId,CTOOLBOX4App::ms_strFullResultPath);
}

// 进程
void CModule::Process(HWND hWnd, sqlite3*db)
{
	GetProcessEx(hWnd, CHECK_PROCESSCHECK, m_bStop, db, CTOOLBOX4App::ms_strMacAddr.GetBuffer(), m_csEventTaskId.GetBuffer());
}

void CModule::NetWorkCard(HWND hWnd, sqlite3* db)
{
	GetNetWorkCard(hWnd, CHECK_NETWORKCARD, m_bStop, db, CTOOLBOX4App::ms_strMacAddr.GetBuffer(), m_csEventTaskId.GetBuffer());
}

// 服务
void CModule::Service(HWND hWnd, sqlite3*db)
{
	
	GetServiceEx(hWnd,CHECK_SERVERCHECK,m_bStop, db, CTOOLBOX4App::ms_strMacAddr.GetBuffer(), m_csEventTaskId.GetBuffer());

}

// 安装软件
void CModule::SoftWare(HWND hWnd, sqlite3*db)
{
	// 安装软件
	GetInsSoftwareInfo(CHECK_SOFTCHECK,hWnd,m_bStop,TEXT(""), db, CTOOLBOX4App::ms_strMacAddr, m_csEventTaskId);
}

// 安全基线
void CModule::AccountSec(HWND hWnd, sqlite3*db)
{

		GetOSAuthBSAEx(hWnd,CHECK_SECBASELINECHECK1,m_bStop, db, CTOOLBOX4App::ms_strMacAddr, m_csEventTaskId);

		if(CModule::m_bStop)
		{
			return;
		}
		GetOsAccountSecBSAEx(hWnd,CHECK_SECBASELINECHECK2,m_bStop, db, CTOOLBOX4App::ms_strMacAddr, m_csEventTaskId);

		if(CModule::m_bStop)
		{
			return;
		}

		// 服务访问安全
		GetOSServiceBSAEx(hWnd,CHECK_SECBASELINECHECK3,m_bStop, db, CTOOLBOX4App::ms_strMacAddr, m_csEventTaskId);

		if(CModule::m_bStop)
		{
			return;
		}

		// 口令安全
		GetOSPasswordBSAEx(hWnd,CHECK_SECBASELINECHECK4,m_bStop, db, CTOOLBOX4App::ms_strMacAddr, m_csEventTaskId);

		if(CModule::m_bStop)
		{
			return;
		}

		// 网络访问安全
		GetOSNetAccCtrlSecBSAEx(hWnd,CHECK_SECBASELINECHECK5,m_bStop, db, CTOOLBOX4App::ms_strMacAddr, m_csEventTaskId);

		if(CModule::m_bStop)
		{
			return;
		}

		// 文件访问安全

		GetFileAccCtrlSecBSAEx(hWnd,CHECK_SECBASELINECHECK6,m_bStop, db, CTOOLBOX4App::ms_strMacAddr, m_csEventTaskId);

}

// 文件共享
void CModule::FileShare(HWND hWnd, sqlite3*db)
{
	//文件共享
	GetShareInfo(CHECK_FILESHARE, hWnd, m_bStop, TEXT(""), db, CTOOLBOX4App::ms_strMacAddr, m_csEventTaskId);
}

// USB插拔记录
void CModule::USBTrace(HWND hWnd, int nType, sqlite3*db)
{
	int type = nType;
	switch(nType)
	{
	case 1:
		{
			// USB插拔记录

			GetUSBRecordEx(hWnd,CHECK_USBCHECK,m_bStop, db, CTOOLBOX4App::ms_strMacAddr, m_csEventTaskId);

			break;
		}

	case 2: // 全盘采集
		{
			// USB插拔记录
			GetUSBRecordEx(hWnd,CHECK_USBCHECK,m_bStop, db, CTOOLBOX4App::ms_strMacAddr, m_csEventTaskId);
			break;
			/*
			// 屏蔽 介质痕迹深度
			break;

			// 介质  深度 (全盘)
			CString str = NULL;
			int index = 0;
			for(int i = 0; i < CPage4::m_strDisk.GetLength()/3;i++)
			{
				// 从"C:;D:;E:;"中 拿到CDE
				str += CPage4::m_strDisk.Mid(index,1);
				index += 3;
			}
			//AfxMessageBox(str);
			USBDeepCheck(hWnd, CHECK_USBDEEP, m_bStop, str);
			break;
			*/
		}
	case 3: // 自定义采集
		{
			// USB插拔记录
			GetUSBRecordEx(hWnd,CHECK_USBCHECK,m_bStop, db, CTOOLBOX4App::ms_strMacAddr, m_csEventTaskId);
			break;
			/*
			// 屏蔽 介质痕迹深度
			break;

			// 介质 深度 (自定义盘符)
			CString str(CPage4::m_strSelDisk);
			str.Replace(_T(":;"), _T(""));
			USBDeepCheck(hWnd, CHECK_USBDEEP, m_bStop, str);
			break;
			*/
		}
	default:
		break;
	}

}

BOOL CopyLogDir(CString strSrcPath, CString strDstPath)      //拷贝文件夹及其中的所有内容
{ // 创建目标文件夹
	if (strSrcPath.Right(1) == "\\")
	{
		strSrcPath = strSrcPath.Left(strSrcPath.GetLength() - 1);
	}
	if (strDstPath.Right(1) == "\\")
	{
		strDstPath = strDstPath.Left(strDstPath.GetLength() - 1);
	}
	CreateDirectory(strDstPath,NULL);
	CFileFind finder;
	// 打开指定的文件夹进行搜索
	BOOL bWorking = finder.FindFile(strSrcPath + "\\" + "*.*"); 
	while(bWorking) 
	{
		// 从当前目录搜索文件
		bWorking = finder.FindNextFile();
		CString strFileName = finder.GetFileName(); 
		CString strSrc = strSrcPath + "\\" + strFileName;
		CString strDst = strDstPath + "\\" + strFileName;
		// 判断搜索到的是不是"."和".."目录

		if(!finder.IsDots())

		{

			// 判断搜索到的目录是否是文件夹

			if(finder.IsDirectory())

			{

				// 如果是文件夹的话，进行递归

				if(!CopyLogDir(strSrc, strDst)) 
				{
					return FALSE;
				}
			}
			else
			{
				// 如果是文件，进行复制
				if(!CopyFile(strSrc, strDst, FALSE))
				{
					if (!PathFileExists(strDst))
					{
						return FALSE;
					}
				}
			} 
		}
	}       
	return TRUE;
}

// 写Sqlite3
void CModule::WriteSqlite3(HWND hWnd, int nTaskID,int nType,CTime stStartTime,CTime stEndTime )
{
	//OutputDebugString(_T("u001"));
	//WaitForSingleObject(CPage2::m_hSoftWare_Fast, INFINITE);
	//OutputDebugString(_T("u002"));
	//WaitForSingleObject(CPage3::m_hSoftWare_all, INFINITE);
	//OutputDebugString(_T("u003"));
	//WaitForSingleObject(CPage5::m_hSoftWare_custom, INFINITE);
	//OutputDebugString(_T("u004"));
	//WaitForSingleObject(CPage2::m_hSecBaseLine_Fase, INFINITE);
	//OutputDebugString(_T("u005"));
	//WaitForSingleObject(CPage3::m_hSecBaseLine_All, INFINITE);
	//OutputDebugString(_T("u006"));
	//WaitForSingleObject(CPage5::m_hSecBaseLine_Custom, INFINITE);
	//OutputDebugString(_T("u007"));
	CStdioFile Cfe;
	std::vector<CString> vSubDir;
	CString sAttack;
	std::vector<CString>::iterator it;

	//////////////////////////////
	int mTaskId = nTaskID;
	TASKPROGRESS ofX1;
	ofX1.pszText = _T("正在进行结果分析,请稍候...");
	ofX1.nProgress = 5;
	::SendMessage(hWnd, WM_RETPROGRESS, (WPARAM)&mTaskId, (LPARAM)&ofX1);
	/////////////////////////////

	TCHAR *pAttackPath = new TCHAR[MAX_PATH+ 1];
	memset(pAttackPath, 0, sizeof(TCHAR) * (MAX_PATH + 1));
	if(CTOOLBOX4App::m_bisUDisk)
	{
		_sntprintf_s(pAttackPath, MAX_PATH + 1, MAX_PATH, _T("%s\\采集结果\\%s\\WebAttackAction"), CTOOLBOX4App::m_strSavePathKey.GetBuffer(), CDisposeResult::m_strMacAddr.GetBuffer());
	}
	else
	{
		_sntprintf_s(pAttackPath, MAX_PATH + 1, MAX_PATH, _T("%s\\采集工具\\采集结果\\%s\\WebAttackAction"), CTOOLBOX4App::m_strSavePath.GetBuffer(), CDisposeResult::m_strMacAddr.GetBuffer());
	}
	if(CModule::m_bStop)
		return;

	//int Size1 = Sub1.GetLength();
	//int Size2 = Sub2.GetLength();

	CString strMac = CTOOLBOX4App::ms_strMacAddr;
	CString strIP=CTOOLBOX4App::ms_strIP;
	CString TaskID = CModule::m_csEventTaskId;
	///////////////////////////////
	if(CModule::m_bStop)
		return;
	sAttack = pAttackPath;
	//OutputDebugString(_T("u02"));
	YDGetSubDirectory(sAttack, vSubDir);
	auto nSize = vSubDir.size();
	int i = 0;
	//OutputDebugString(_T("for up"));
	CString strInfo;
	strInfo.Format(_T("WebSize=[%d]"), nSize);
	OutputDebugString(strInfo);
	CString path = _T("");
	CString DestPath = _T("");
	for(it = vSubDir.begin(); it != vSubDir.end(); it++)
	{
		OutputDebugString(_T("u04"));
		if(CModule::m_bStop)
			return;
		/////
		OutputDebugString(_T("u05"));
		TASKPROGRESS ofX2;
		ofX2.pszText = _T("正在进行结果分析,请稍候");
		ofX2.nProgress =static_cast<int>(5+ (35/nSize)*(i+1));
		::SendMessage(hWnd, WM_RETPROGRESS, (WPARAM)&mTaskId, (LPARAM)&ofX2);
		/////
		if(*it == vSubDir.back()) // 最后一个文件夹的时候, 是自定义采集. 
		{
			CTOOLBOX4App::m_bIsSub = TRUE; // 如果没有自定义采集, 列数差为0, 进入次分支也没问题
		}
		else
		{
			CTOOLBOX4App::m_bIsSub = FALSE;
		}

		path = *it;
		DestPath = sAttack + _T("\\")+ path;
		CString strNewLogsPath;
		CString sIniFile;
		std::wstring DesstrLogPath;
		CString sSecName = _T("LogPath");
		strNewLogsPath=DestPath+_T("\\logs");
		CreateDirectory(strNewLogsPath, NULL);
		sIniFile=DestPath+_T("\\MiddleWare.ydini");
		GetIniFileKeyValue(sIniFile.GetBuffer(), sSecName.GetBuffer(), _T("LogPath"), DesstrLogPath);
		CopyLogDir(DesstrLogPath.c_str(), strNewLogsPath);
		//OutputDebugString(DestPath);
		OutputDebugString(_T("u06"));
		CParseWebResultFile parse(DestPath);
		//MyIntBox(strMac.GetLength());
		//OutputDebugString(_T("mac="));
		OutputDebugString(strMac);
		parse.SetMacAddress(strMac);
		if(CModule::m_bStop)
			return;
		//OutputDebugString(_T("TaskID="));
		OutputDebugString(TaskID);
		parse.SetEventTaskId(TaskID);
		parse.SetHostIP(strIP);
		if(CModule::m_bStop)
			return;
		//OutputDebugString(_T("ParseResultFiles"));
		parse.ParseResultFiles(stStartTime,stEndTime);
		OutputDebugString(_T("down02"));
		i++;
		if(CModule::m_bStop)
			return;
	}
	
	//OutputDebugString(_T("for end"));
	//OutputDebugString(sAttack);
	CString strPath;
	strPath = sAttack;
	strPath += _T("\\Result1");
	OutputDebugString(_T("u09"));
	CParseWebResultFile cpFile(strPath);
	strPath = CTOOLBOX4App::ms_strMacAddr;
	//OutputDebugString(_T("02"));
	cpFile.SetMacAddress(strPath);
	//OutputDebugString(_T("03"));
	strPath = CModule::m_csEventTaskId;
	cpFile.SetEventTaskId(strPath);
	//OutputDebugString(_T("04"));

	strPath = CTOOLBOX4App::ms_strFullResultPath;
	strPath += _T("病毒");
	cpFile.SetHostIP(strIP);
//	cpFile.ParseVirusPath(strPath);

	OutputDebugString(_T("down01"));
	if(CModule::m_bStop)
		return; 
	/////
	TASKPROGRESS ofX3;
	ofX3.pszText = _T("正在进行结果分析,请稍候...");
	ofX3.nProgress = 50;
	::SendMessage(hWnd, WM_RETPROGRESS, (WPARAM)&mTaskId, (LPARAM)&ofX3);
	/////
	if(pAttackPath != NULL)
	{
		delete []pAttackPath;
		pAttackPath = NULL;
	}
	OutputDebugString(_T("WriteSqlite3() end"));
}

// 删除xml文件
void CModule::MyDeleteFile(CString FilePath)
{
	CFileFind finder;  
	CString path;  
	path.Format(TEXT("%s\\*.*"),FilePath);  
	BOOL bWorking = finder.FindFile(path);  
	while(bWorking)
	{ 
		bWorking = finder.FindNextFile();
		if (finder.IsDots())
		{
			continue;
		}

		CString strNextPath(finder.GetFilePath());
		if(finder.IsDirectory())
		{//处理文件夹 
			MyDeleteFile(strNextPath); //递归删除文件夹  
			//RemoveDirectory(strNextPath);  
		}  
		else
		{//处理文件
			SetFileAttributes(strNextPath ,FILE_ATTRIBUTE_ARCHIVE);
			if(strNextPath.Find(_T(".xml")) != -1 || strNextPath.Find(_T(".ydxml")) != -1)
				DeleteFile(strNextPath);
		}
	}
	finder.Close();
}

// 主动杀死 病毒扫描进程 (点击停止按钮时调用)
void CModule::KillVirusScanProc()
{
	if(m_vHandle.empty())
		return;
	vector<PROCESS_INFORMATION>::iterator it;
	for(it = m_vHandle.begin(); it != m_vHandle.end(); ++it)
	{
		TerminateProcess(it->hProcess, 34);
	}
}




BEGIN_MESSAGE_MAP(CModule, CWnd)
END_MESSAGE_MAP()



// CModule message handlers


